Time series search engine

Abstract

Methods and apparatus consistent with the invention provide the ability to organize, index, search, and present time series data based on searches. Time series data are sequences of time stamped records occurring in one or more usually continuous streams, representing some type of activity. In one embodiment, time series data is organized into discrete events with normalized time stamps and the events are indexed by time and keyword. A search is received and relevant event information is retrieved based in whole or in part on the time indexing mechanism, keyword indexing mechanism, or statistical indices calculated at the time of the search.

Description

CROSS-REFERENCE TO RELATED APPLICATION[0001]This application claims priority under 35 U.S.C. §119(e) to U.S. Provisional Patent Application Ser. No. 60 / 828,283, “Times Series Search Engine,” filed Oct. 5, 2006. The subject matter of all of the foregoing is incorporated herein by reference in its entirety.BACKGROUND OF THE INVENTION[0002]1. Field of the Invention[0003]This invention relates generally to information organization, search, and retrieval and more particularly to time series data organization, search, and retrieval.[0004]2. Description of the Related Art[0005]Time series data are sequences of time stamped records occurring in one or more usually continuous streams, representing some type of activity made up of discrete events. Examples include information processing logs, market transactions, and sensor data from real-time monitors (supply chains, military operation networks, or security systems). The ability to index, search, and present relevant search results is import...

AI Technical Summary

Benefits of technology

[0021]The creation of time bucket indices facilitates the execution of time series searches. In one approach, a time series search request is divided into different sub-searches for the affected time buckets, with each sub-search executed across the corresponding time bucket index.

Problems solved by technology

Existing search solutions generally have little notion of time-based indexing, searching or relevancy in the presentation of results and don't meet the needs of time series data.

However, indexing time series data is further complicated because the data can be collected from multiple, different sources asynchronously and out of order.

Furthermore, time stamps can have an almost unlimited number of formats making identification and interpretation difficult.

Time stamps within the data can be hard to locate, with no standard for location, format, or temporal granularity (e.g. day, hour, minute, second, sub-second).

Timeframes and time-based metadata like frequency, distribution, and likelihood of occurrence are especially important when searching time series data, but difficult to achieve with current search engine approaches.

Some existing limited applications of time-based search exist in specific small-scale domains.

However, searches are limited to simple time functions like before, after, or time ranges; the data sets are generally small scale and highly structured from a single domain; and the real-time indexing mechanisms are append only, usually requiring the rebuilding of the entire index to interleave new data.

Also unique to the cyclicality of time series data is the challenge of presenting useful results.

Enabling real-time operation against large, frequently changing data sets can be difficult with traditional large-scale search engines that optimize for small search response times at the expense of rapid data availability.

This process can take hours or even days to complete depending on the size of the data set and density of the index.

Other software that is focused on time series, e.g., log event analyzers such as Sawmill or Google's Sawzall can provide real-time analysis capabilities but are not search engines per se because they do not provide for ad hoc searches.

Additionally, no general keyword-based or time-based search mechanisms are available.

Other streaming data research projects (including the Stanford Streams project and products from companies like StreamBase Systems) can also produce analysis and alerting of streaming data but do not provide any persistence of data, indexing, time-based, or keyword-based searching.

Images